Fixed potential crash on destroying MenuRunnerImplCocoa.

ui/views/controls/menu/menu_runner_cocoa_unittest.mm

Index: ui/views/controls/menu/menu_runner_cocoa_unittest.mm
diff --git a/ui/views/controls/menu/menu_runner_cocoa_unittest.mm b/ui/views/controls/menu/menu_runner_cocoa_unittest.mm
index d25a6628b47db5294dba95b81c3816386746ed48..7505e66b62a82c9ada647b58fc5c8309c8045d41 100644
--- a/ui/views/controls/menu/menu_runner_cocoa_unittest.mm
+++ b/ui/views/controls/menu/menu_runner_cocoa_unittest.mm
@@ -159,6 +159,19 @@ TEST_F(MenuRunnerCocoaTest, RunMenuAndDelete) {
   EXPECT_EQ(MenuRunner::MENU_DELETED, result);
 }
 
+// Tests that there is no "use after free" when we canceling menu
+// (that causes deferred destructor in MenuRunnerImplCocoa::RunMenuAt()) and
+// release it just after canceling (that was cause destructor
+// in MenuRunnerImplCocoa::Release()).

[tapted, 2016/04/12 06:22:58]

this comment is a bit hard to read perhaps

// Ensure a menu can be safely released immediately after a call to Cancel() in
the same run loop iteration.

+TEST_F(MenuRunnerCocoaTest, DestroyAfterCanceling) {
+  MenuRunner::RunResult result = RunMenu(^{

[tapted, 2016/04/12 06:22:58]

We got rid of all the Objective C blocks in this file recently - see
https://codereview.chromium.org/1829603002/ for the "new way" - you'll need to
sync past r385940 and rebase

+    runner_->Cancel();
+    runner_->Release();

[tapted, 2016/04/12 06:22:58]

Is there code in Chrome that already follows this pattern?

+    runner_ = nullptr;
+  });
+  EXPECT_EQ(MenuRunner::MENU_DELETED, result);
+}
+
 TEST_F(MenuRunnerCocoaTest, RunMenuTwice) {
   for (int i = 0; i < 2; ++i) {
     MenuRunner::RunResult result = RunMenu(^{